Commit 93fea12e authored by Thomas Gerbet's avatar Thomas Gerbet Committed by github-actions[bot]
Browse files

redmine: 5.0.5 -> 5.0.6 

Fixes CVE-2023-47258, CVE-2023-47259 and CVE-2023-47260.

Changelog:
https://www.redmine.org/projects/redmine/wiki/Changelog_5_0#506-2023-09-30
(cherry picked from commit 97671108)
parent a81f9412

pkgs/applications/version-management/redmine/Gemfile

+12 −5
Original line number Diff line number Diff line
@@ -3,7 +3,7 @@ source 'https://rubygems.org' 
ruby '>= 2.5.0', '< 3.2.0'

gem 'bundler', '>= 1.12.0'



gem 'rails', '6.1.7.2'

gem 'rails', '6.1.7.6'

gem 'globalid', '~> 0.4.2' if Gem.ruby_version < Gem::Version.new('2.6.0')

gem 'rouge', '~> 3.28.0'

gem 'request_store', '~> 1.5.0'
@@ -13,10 +13,16 @@ gem 'roadie-rails', (Gem.ruby_version < Gem::Version.new('2.6.0') ? '~> 2.2.0' : 
gem 'marcel'

gem "mail", "~> 2.7.1"

gem 'csv', '~> 3.2.0'

gem 'nokogiri', (Gem.ruby_version < Gem::Version.new('2.6.0') ? '~> 1.12.5' : '~> 1.13.10')

gem "rexml"

gem 'nokogiri', (if Gem.ruby_version < Gem::Version.new('2.6.0')

                   '~> 1.12.5'

                 elsif Gem.ruby_version < Gem::Version.new('2.7.0')

                   '~> 1.13.10'

                 else

                   '~> 1.15.2'

                 end)

gem "rexml", require: false if Gem.ruby_version >= Gem::Version.new('3.0')

gem 'i18n', '~> 1.10.0'

gem 'rbpdf', '~> 1.21.0'

gem 'rbpdf', '~> 1.21.3'

gem 'addressable'

gem 'rubyzip', '~> 2.3.0'

gem 'net-smtp', '~> 0.3.0'
@@ -70,9 +76,10 @@ end 


group :test do

  gem "rails-dom-testing"

  gem 'mocha', (Gem.ruby_version < Gem::Version.new('2.7.0') ? ['>= 1.4.0', '< 2.0.0'] : '>= 1.4.0')

  gem 'mocha', '>= 2.0.1'

  gem 'simplecov', '~> 0.21.2', :require => false

  gem "ffi", platforms: [:mri, :mingw, :x64_mingw, :mswin]

  # For running system tests

  gem 'puma', (Gem.ruby_version < Gem::Version.new('2.7') ? '< 6.0.0' : '>= 0')

  gem 'capybara', (if Gem.ruby_version < Gem::Version.new('2.6')

                     '~> 3.35.3'

pkgs/applications/version-management/redmine/Gemfile.lock

+102 −102
Original line number Diff line number Diff line 
GEM

  remote: https://rubygems.org/

  specs:

    actioncable (6.1.7.2)

      actionpack (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    actioncable (6.1.7.6)

      actionpack (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      nio4r (~> 2.0)

      websocket-driver (>= 0.6.1)

    actionmailbox (6.1.7.2)

      actionpack (= 6.1.7.2)

      activejob (= 6.1.7.2)

      activerecord (= 6.1.7.2)

      activestorage (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    actionmailbox (6.1.7.6)

      actionpack (= 6.1.7.6)

      activejob (= 6.1.7.6)

      activerecord (= 6.1.7.6)

      activestorage (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      mail (>= 2.7.1)

    actionmailer (6.1.7.2)

      actionpack (= 6.1.7.2)

      actionview (= 6.1.7.2)

      activejob (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    actionmailer (6.1.7.6)

      actionpack (= 6.1.7.6)

      actionview (= 6.1.7.6)

      activejob (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      mail (~> 2.5, >= 2.5.4)

      rails-dom-testing (~> 2.0)

    actionpack (6.1.7.2)

      actionview (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    actionpack (6.1.7.6)

      actionview (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      rack (~> 2.0, >= 2.0.9)

      rack-test (>= 0.6.3)

      rails-dom-testing (~> 2.0)
@@ -30,40 +30,40 @@ GEM 
    actionpack-xml_parser (2.0.1)

      actionpack (>= 5.0)

      railties (>= 5.0)

    actiontext (6.1.7.2)

      actionpack (= 6.1.7.2)

      activerecord (= 6.1.7.2)

      activestorage (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    actiontext (6.1.7.6)

      actionpack (= 6.1.7.6)

      activerecord (= 6.1.7.6)

      activestorage (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      nokogiri (>= 1.8.5)

    actionview (6.1.7.2)

      activesupport (= 6.1.7.2)

    actionview (6.1.7.6)

      activesupport (= 6.1.7.6)

      builder (~> 3.1)

      erubi (~> 1.4)

      rails-dom-testing (~> 2.0)

      rails-html-sanitizer (~> 1.1, >= 1.2.0)

    activejob (6.1.7.2)

      activesupport (= 6.1.7.2)

    activejob (6.1.7.6)

      activesupport (= 6.1.7.6)

      globalid (>= 0.3.6)

    activemodel (6.1.7.2)

      activesupport (= 6.1.7.2)

    activerecord (6.1.7.2)

      activemodel (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    activestorage (6.1.7.2)

      actionpack (= 6.1.7.2)

      activejob (= 6.1.7.2)

      activerecord (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    activemodel (6.1.7.6)

      activesupport (= 6.1.7.6)

    activerecord (6.1.7.6)

      activemodel (= 6.1.7.6)

      activesupport (= 6.1.7.6)

    activestorage (6.1.7.6)

      actionpack (= 6.1.7.6)

      activejob (= 6.1.7.6)

      activerecord (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      marcel (~> 1.0)

      mini_mime (>= 1.1.0)

    activesupport (6.1.7.2)

    activesupport (6.1.7.6)

      concurrent-ruby (~> 1.0, >= 1.0.2)

      i18n (>= 1.6, < 2)

      minitest (>= 5.1)

      tzinfo (~> 2.0)

      zeitwerk (~> 2.3)

    addressable (2.8.4)

    addressable (2.8.5)

      public_suffix (>= 2.0.2, < 6.0)

    ast (2.4.2)

    builder (3.2.4)
@@ -78,20 +78,20 @@ GEM 
      xpath (~> 3.2)

    childprocess (3.0.0)

    chunky_png (1.4.0)

    commonmarker (0.23.9)

    commonmarker (0.23.10)

    concurrent-ruby (1.2.2)

    crass (1.0.6)

    css_parser (1.14.0)

    css_parser (1.16.0)

      addressable

    csv (3.2.6)

    csv (3.2.8)

    deckar01-task_list (2.3.2)

      html-pipeline

    digest (3.1.1)

    docile (1.4.0)

    erubi (1.12.0)

    ffi (1.15.5)

    globalid (1.1.0)

      activesupport (>= 5.0)

    ffi (1.16.3)

    globalid (1.2.1)

      activesupport (>= 6.1)

    html-pipeline (2.13.2)

      activesupport (>= 2)

      nokogiri (>= 1.4)
@@ -101,7 +101,7 @@ GEM 
    listen (3.8.0)

      rb-fsevent (~> 0.10, >= 0.10.3)

      rb-inotify (~> 0.9, >= 0.9.10)

    loofah (2.21.3)

    loofah (2.22.0)

      crass (~> 1.0.2)

      nokogiri (>= 1.12.0)

    mail (2.7.1)
@@ -110,10 +110,10 @@ GEM 
    matrix (0.4.2)

    method_source (1.0.0)

    mini_magick (4.11.0)

    mini_mime (1.1.2)

    mini_portile2 (2.8.2)

    minitest (5.18.1)

    mocha (2.0.4)

    mini_mime (1.1.5)

    mini_portile2 (2.8.5)

    minitest (5.20.0)

    mocha (2.1.0)

      ruby2_keywords (>= 0.0.5)

    mysql2 (0.5.5)

    net-imap (0.2.3)
@@ -123,75 +123,75 @@ GEM 
    net-ldap (0.17.1)

    net-pop (0.1.2)

      net-protocol

    net-protocol (0.2.1)

    net-protocol (0.2.2)

      timeout

    net-smtp (0.3.3)

      net-protocol

    nio4r (2.5.9)

    nokogiri (1.13.10)

      mini_portile2 (~> 2.8.0)

      racc (~> 1.4)

    nokogiri (1.13.10-x86_64-linux)

    nio4r (2.6.1)

    nokogiri (1.15.5)

      mini_portile2 (~> 2.8.2)

      racc (~> 1.4)

    parallel (1.23.0)

    parser (3.2.2.3)

    parser (3.2.2.4)

      ast (~> 2.4.1)

      racc

    pg (1.4.6)

    public_suffix (5.0.1)

    puma (6.3.0)

    public_suffix (5.0.4)

    puma (6.4.0)

      nio4r (~> 2.0)

    racc (1.7.1)

    rack (2.2.7)

    racc (1.7.3)

    rack (2.2.8)

    rack-test (2.1.0)

      rack (>= 1.3)

    rails (6.1.7.2)

      actioncable (= 6.1.7.2)

      actionmailbox (= 6.1.7.2)

      actionmailer (= 6.1.7.2)

      actionpack (= 6.1.7.2)

      actiontext (= 6.1.7.2)

      actionview (= 6.1.7.2)

      activejob (= 6.1.7.2)

      activemodel (= 6.1.7.2)

      activerecord (= 6.1.7.2)

      activestorage (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    rails (6.1.7.6)

      actioncable (= 6.1.7.6)

      actionmailbox (= 6.1.7.6)

      actionmailer (= 6.1.7.6)

      actionpack (= 6.1.7.6)

      actiontext (= 6.1.7.6)

      actionview (= 6.1.7.6)

      activejob (= 6.1.7.6)

      activemodel (= 6.1.7.6)

      activerecord (= 6.1.7.6)

      activestorage (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      bundler (>= 1.15.0)

      railties (= 6.1.7.2)

      railties (= 6.1.7.6)

      sprockets-rails (>= 2.0.0)

    rails-dom-testing (2.0.3)

      activesupport (>= 4.2.0)

    rails-dom-testing (2.2.0)

      activesupport (>= 5.0.0)

      minitest

      nokogiri (>= 1.6)

    rails-html-sanitizer (1.5.0)

      loofah (~> 2.19, >= 2.19.1)

    railties (6.1.7.2)

      actionpack (= 6.1.7.2)

      activesupport (= 6.1.7.2)

    rails-html-sanitizer (1.6.0)

      loofah (~> 2.21)

      nokogiri (~> 1.14)

    railties (6.1.7.6)

      actionpack (= 6.1.7.6)

      activesupport (= 6.1.7.6)

      method_source

      rake (>= 12.2)

      thor (~> 1.0)

    rainbow (3.1.1)

    rake (13.0.6)

    rake (13.1.0)

    rb-fsevent (0.11.2)

    rb-inotify (0.10.1)

      ffi (~> 1.0)

    rbpdf (1.21.1)

    rbpdf (1.21.3)

      htmlentities

      rbpdf-font (~> 1.19.0)

    rbpdf-font (1.19.1)

    redcarpet (3.5.1)

    regexp_parser (2.8.1)

    regexp_parser (2.8.2)

    request_store (1.5.1)

      rack (>= 1.4)

    rexml (3.2.5)

    roadie (5.1.0)

    rexml (3.2.6)

    roadie (5.2.0)

      css_parser (~> 1.4)

      nokogiri (~> 1.8)

      nokogiri (~> 1.15)

    roadie-rails (3.0.0)

      railties (>= 5.1, < 7.1)

      roadie (~> 5.0)

    rotp (6.2.2)

    rotp (6.3.0)

    rouge (3.28.0)

    rqrcode (2.2.0)

      chunky_png (~> 1.0)
@@ -206,7 +206,7 @@ GEM 
      rubocop-ast (>= 1.16.0, < 2.0)

      ruby-progressbar (~> 1.7)

      unicode-display_width (>= 1.4.0, < 3.0)

    rubocop-ast (1.29.0)

    rubocop-ast (1.30.0)

      parser (>= 3.2.1.0)

    rubocop-performance (1.13.3)

      rubocop (>= 1.7.0, < 2.0)
@@ -218,7 +218,7 @@ GEM 
    ruby-progressbar (1.13.0)

    ruby2_keywords (0.0.5)

    rubyzip (2.3.2)

    sanitize (6.0.1)

    sanitize (6.1.0)

      crass (~> 1.0.2)

      nokogiri (>= 1.12.0)

    selenium-webdriver (3.142.7)
@@ -230,31 +230,31 @@ GEM 
      simplecov_json_formatter (~> 0.1)

    simplecov-html (0.12.3)

    simplecov_json_formatter (0.1.4)

    sprockets (4.2.0)

    sprockets (4.2.1)

      concurrent-ruby (~> 1.0)

      rack (>= 2.2.4, < 4)

    sprockets-rails (3.4.2)

      actionpack (>= 5.2)

      activesupport (>= 5.2)

      sprockets (>= 3.0.0)

    strscan (3.0.6)

    thor (1.2.2)

    timeout (0.4.0)

    strscan (3.0.7)

    thor (1.3.0)

    timeout (0.4.1)

    tzinfo (2.0.6)

      concurrent-ruby (~> 1.0)

    unicode-display_width (2.4.2)

    unicode-display_width (2.5.0)

    webdrivers (4.6.1)

      nokogiri (~> 1.6)

      rubyzip (>= 1.3.0)

      selenium-webdriver (>= 3.0, < 4.0)

    webrick (1.8.1)

    websocket-driver (0.7.5)

    websocket-driver (0.7.6)

      websocket-extensions (>= 0.1.0)

    websocket-extensions (0.1.5)

    xpath (3.2.0)

      nokogiri (~> 1.8)

    yard (0.9.34)

    zeitwerk (2.6.8)

    zeitwerk (2.6.12)



PLATFORMS

  ruby
@@ -275,18 +275,18 @@ DEPENDENCIES 
  marcel

  mini_magick (~> 4.11.0)

  mini_mime (~> 1.1.0)

  mocha (>= 1.4.0)

  mocha (>= 2.0.1)

  mysql2 (~> 0.5.0)

  net-imap (~> 0.2.2)

  net-ldap (~> 0.17.0)

  net-pop (~> 0.1.1)

  net-smtp (~> 0.3.0)

  nokogiri (~> 1.13.10)

  nokogiri (~> 1.15.2)

  pg (~> 1.4.2)

  puma

  rails (= 6.1.7.2)

  rails (= 6.1.7.6)

  rails-dom-testing

  rbpdf (~> 1.21.0)

  rbpdf (~> 1.21.3)

  redcarpet (~> 3.5.1)

  request_store (~> 1.5.0)

  rexml
@@ -307,7 +307,7 @@ DEPENDENCIES 
  yard



RUBY VERSION

   ruby 2.7.7p221

   ruby 3.1.4p223



BUNDLED WITH

   2.3.26
 
   2.4.12

pkgs/applications/version-management/redmine/default.nix

+2 −2
Original line number Diff line number Diff line 
{ lib, stdenv, fetchurl, bundlerEnv, ruby, defaultGemConfig, makeWrapper, nixosTests }:



let

  version = "5.0.5";

  version = "5.0.6";

  rubyEnv = bundlerEnv {

    name = "redmine-env-${version}";
@@ -16,7 +16,7 @@ in 


    src = fetchurl {

      url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";

      sha256 = "sha256-qJrRxLub8CXmUnx3qxjI+vd0nJSpdcryz9u6AOsSpIE=";

      hash = "sha256-SI/gjzeo6xARQVkiqOp0O3842Kel+IIpUKNKN13PCO4=";

    };



    nativeBuildInputs = [ makeWrapper ];

pkgs/applications/version-management/redmine/gemset.nix

+100 −100

File changed.

Preview size limit exceeded, changes collapsed.